Monitoring of network traffic has become ubiquitous in the field of networking for troubleshooting and to support various applications. Techniques include local traffic monitoring and remote traffic monitoring. Local traffic monitoring involves the use of a network analyzer coupled to a local switch or network device. Packets received or transmitted from a local port are duplicated and also sent to another local port that is coupled to the network analyzer. The network analyzer then analyzes the traffic. In remote traffic monitoring, the duplicated packets are sent over the network to a remote switch that is coupled to the network analyzer. The traffic is analyzed at the remote location.
In networks that transmit voice, time division multiplexing (TDM) networks have been used since the 1960's in telecommunications networks to digitally transmit voice. As such, TDM networks have been developed with a robust suite of tools, e.g., an Operations, Administration, and Management suite, which maintains a level of reliability that telecommunications operators have grown to expect. With the advent of optical networks, telecommunications operators have applied TDM to Synchronous Optical Networking (SONET) and Synchronous Digital Hierarchy (SDH) optical networks.
Over time, the telecommunications industry has experienced increasing economic pressure to integrate different services, e.g., by adding packet based services to TDM services and vice versa. Furthermore, with their availability and low cost, packet based networks are the choice of many organizations to transmit voice and video. However, packet based networks do not have the robust management tools available to TDM networks. Furthermore, the voice and video packets are encrypted since many packets may travel over a public network. Traditional network analysis tools use packet headers for analysis and call route tracing, but these headers are unavailable when the packets are encrypted.